Keep Jamf in 2026: fill the gaps in SaaS app delivery, app discovery and BYOD laptops
Jamf manages company Macs. What to add for SaaS app delivery, app discovery and BYOD laptops, and what to do with no MDM. 8 tools ranked.
Updated 27 October 2026 by Simon Mestdagh, founder of Caspian.
TL;DR
- If you run Jamf, keep it. Jamf manages company Macs well. The gaps are SaaS app delivery (the account and access in each SaaS app), app discovery (the web apps and AI tools people use outside the Mac), and BYOD laptops that are not enrolled in your MDM. Add an IT management platform such as Caspian for those three.
- Jamf Pro's product page lists device work: zero-touch setup, Smart Groups, Blueprints, inventory, app lifecycle management, Self Service+ and compliance benchmarks. It does not describe creating accounts in apps like Slack or GitHub, or answering access requests (Jamf Pro, checked 27 October 2026).
- Jamf supports BYOD through Apple's User Enrollment. On a personally owned device, Apple lets an MDM apply "only a limited set of payloads and restrictions", and the person still has to enroll (Apple Platform Deployment, checked 27 October 2026).
- If you have no MDM yet, start with the free MDM in Apple Business, or Caspian MDM (early access), and run apps, accounts and access in Caspian.
Caspian publishes this article and sells a product in this space. We rank Caspian first for the fit described below, and we say where another tool is the better pick. Facts were checked on 27 October 2026.
Who this is for
You are the one IT person, or one of two, at a Mac-first company of 100 to 1,500 people. Sign-in runs on Google Workspace or Microsoft Entra. People live in Slack. Jamf already manages the company Macs, or you are deciding whether you need it.
Your current state: Jamf sets up the Mac on day one. Then you spend the rest of the week on everything after the device. You create the Slack account, add the Google groups, invite the person to GitHub, set their Notion role, and chase the contractor whose personal Mac you cannot see. When someone leaves, you work through the same list in reverse and hope you did not miss one.
The future state this article points to: Jamf keeps the device. Something else creates and removes the accounts, puts people in the right teams and channels, shows you which apps are in use, and checks the Macs you do not own.
How we picked
We ranked tools on six jobs a one-person IT team does around Jamf:
- Laptop apps: install and update Mac apps, including ones outside the App Store.
- SaaS accounts: create and remove the person's account in each SaaS app.
- Resources inside apps: teams, repos, channels and roles.
- Apps without SCIM: many SaaS apps have no SCIM, or keep it on an enterprise plan.
- BYOD Macs: check a personal Mac that is not enrolled in an MDM.
- HR-triggered joiner and leaver: start the work from the HR system.
We checked each vendor's own product pages on 27 October 2026. Where a page does not say whether a tool does something, we write "Not stated". That means we could not confirm it, not that the tool cannot do it. Ask the vendor.
We sell Caspian, so we rank it first for this exact fit: keep Jamf, fill the gaps. If you want one vendor to replace Jamf entirely, see the Iru, Mosyle and JumpCloud entries.
Why the gaps matter: offboarding
The leaver is where the gaps cost the most. NIST SP 800-53 control PS-4, Personnel Termination, says that upon termination an organization should "disable system access within [Assignment: organization-defined time period]" and revoke the person's authenticators and credentials (NIST SP 800-53 Rev. 5; control text via CSF Tools, checked 27 October 2026). Wiping or locking the Mac does none of that inside Slack, GitHub or Notion.
Verizon's 2026 Data Breach Investigations Report says the most frequent breach causes "continue to heavily involve the human element", including stolen credentials (Verizon DBIR, checked 27 October 2026). An account left open after someone leaves is a credential nobody watches.
The ranked list
1. Caspian
Best for: a small IT team that keeps Jamf and needs SaaS app delivery, app discovery and BYOD laptops covered.
This section describes our own product. Caspian is an IT management platform: one place for all of IT, so a one-person IT team works like a team of five. It works on three layers, in and out: the apps on the laptop, the account in each SaaS app, and the resources inside each app (teams, repos, channels, roles).
Next to Jamf, you use Caspian for the second and third layers and for the Macs Jamf cannot see:
- Joiner, mover and leaver workflows start from your HR system. HiBob, Personio, BambooHR, Workday and Rippling are supported.
- SaaS app delivery. Caspian makes the account and the access through the route each app allows. It uses the app's API integration first. If there is no API and no SCIM, Caspian's cloud browser signs in as an admin and makes the change, even with your laptop closed. If that fails, the browser extension in an admin's Chrome does it. If that fails too, a person gets an Inbox task.
- Every change is checked by reading the app back afterwards.
- Removals are never automatic. A person approves each one in "Access beyond the rules", and Caspian proposes the least destructive step, such as deactivating before deleting.
- Access requests are answered in Slack.
- App discovery. Caspian finds apps and AI tools from Google Workspace or Entra, the browser extension and the desktop agent.
- BYOD laptops. Caspian Desktop runs on Macs that are not enrolled in any MDM. It checks FileVault, firewall, Gatekeeper, screen lock, macOS version and app versions. On any Mac it runs on, it also installs and updates Mac apps, and people can ask the assistant for an app through Self Service.
Limits: Caspian is not an identity provider; sign-in stays with Google Workspace or Microsoft Entra. It does not manage Windows PCs or phones, and it does not replace Jamf's compliance benchmarks. Caspian reads several MDMs today (Iru/Kandji, Fleet, JumpCloud, SimpleMDM, Hexnode). Jamf is not on that list, so Jamf stays your source of truth for company Macs. Caspian.
2. Jamf Pro
Best for: endpoint management and app deployment on company-owned Macs, when someone on the team knows Jamf.
Jamf Pro's page lists zero-touch deployment for Mac, iPhone, iPad and Apple TV; Smart Groups and Blueprints built on Declarative Device Management; automatic inventory of hardware, software and security settings; app lifecycle management and Self Service+; compliance benchmarks and remote security commands; and integrations with Microsoft Entra, Google Workspace and Okta (Jamf Pro, checked 27 October 2026). Francisco Partners closed its purchase of Jamf on 30 January 2026 (Business Wire).
Limits: the product page does not describe creating the user's account in each SaaS app, setting their access inside it, or answering access requests. BYOD needs enrollment. Jamf inventories software on the Macs it manages, so browser-only apps and AI tools do not show up. Our view: if Jamf runs your fleet today, moving off it costs time you do not have. Keep it.
3. Jamf Now
Best for: a very small fleet that needs basic Apple device management with little setup.
Jamf Now's page says it lets you "set up, manage and secure Apple devices in minutes". It lists app distribution, zero-touch deployment, Blueprints, inventory, OS updates, Self Service, FileVault, malware prevention and remote lock. It manages up to 3 devices for free (Jamf Now, checked 27 October 2026).
Limits: it is a device tool. Its page does not describe SaaS accounts, resources inside apps or app discovery beyond the devices it manages.
4. Iru (formerly Kandji)
Best for: teams that want to replace Jamf with one vendor for endpoint, identity and compliance.
Iru describes itself as "a single view of your users, apps, and devices". It sells Endpoint (endpoint management, EDR and vulnerability management "in a single agent" across Apple, Windows and Android), Workforce Identity ("passwordless workforce identity that grants secure access to every app"), and Compliance Automation with a Trust Center (Iru, checked 27 October 2026).
Limits: Iru's identity product is a sign-in layer, so choosing it means moving sign-in off Google Workspace or Entra. Creating accounts in apps with no SCIM, and the resources inside apps, are Not stated on the home page. Caspian reads Iru if you run it.
5. Mosyle
Best for: Mac-first teams that want MDM plus Mac security in one Apple-only tool.
Mosyle's site lists MDM, OS updates and the installation and patching of "virtually any compatible application", a Mac antivirus, privilege management with "Admin On-Demand", encrypted-DNS web filtering, and Mosyle Auth 2, which creates local Mac accounts from your identity provider (Mosyle, checked 27 October 2026).
Limits: Mosyle manages Apple devices and the Mac login. SaaS app accounts, resources inside apps, and BYOD Macs without enrollment are Not stated.
6. JumpCloud
Best for: teams that want directory, SSO and MDM from one vendor, and will move sign-in to it.
JumpCloud's pricing page sells Device Management, SSO and Device Identity Management bundles, and Platform packages that add user lifecycle management. Its top package, Platform Prime, adds SaaS Discovery, SaaS Access Control and SaaS Insights (JumpCloud pricing, checked 27 October 2026).
Limits: SaaS discovery is only in the top package. HR integration is not listed in the pricing table. Apps with no SCIM and BYOD Macs without enrollment are Not stated.
7. Okta Lifecycle Management
Best for: teams already on Okta whose apps mostly support SCIM.
Okta says Lifecycle Management uses your HR system "as the source of truth" and "supports automated provisioning for thousands of apps using the SCIM standard" (Okta Lifecycle Management, checked 27 October 2026).
Limits: Okta is an identity provider, not an MDM, so Jamf stays. Apps without SCIM need an Okta Workflows flow or a person. Our view: for a Mac-first company on Google Workspace, keeping Okta next to Jamf means two extra systems where one IT platform would do.
8. Apple Business (free MDM)
Best for: a company with no MDM that buys new Macs from Apple.
Apple Business went live on 14 April 2026 with built-in device management, Blueprints, zero-touch setup for Macs bought through Apple or an authorized reseller, and App Store app distribution, as a free service (Apple Newsroom, checked 27 October 2026). 9to5Mac calls it "a baseline, not a finish line" (9to5Mac).
Limits: app distribution is described "through the App Store" only. SaaS accounts in third-party apps are not described.
Jamf vs Jamf plus Caspian, by gap
| Job | Jamf Pro alone | Jamf Pro plus Caspian |
|---|---|---|
| Enroll and configure company Macs | Yes | Jamf |
| Endpoint management and compliance benchmarks | Yes | Jamf |
| App deployment on enrolled Macs | Yes, app lifecycle management and Self Service+ | Jamf, or Caspian Desktop |
| SaaS app delivery: the account in each app | Not on the product page | Caspian |
| Resources inside apps: teams, repos, channels, roles | Not on the product page | Caspian |
| Apps with no SCIM and no API | Not on the product page | Caspian cloud browser, extension, or Inbox task |
| Remove accounts when someone leaves | Not on the product page | Caspian, with a person approving each removal |
| Access requests in Slack | Not on the product page | Caspian |
| BYOD laptops that are not enrolled | Needs User Enrollment; limited payloads | Caspian Desktop, no enrollment |
| App discovery: web apps and AI tools | Device inventory only | Caspian, from Google Workspace or Entra, extension and desktop agent |
Sources: Jamf Pro, Apple Platform Deployment. "Not on the product page" means Jamf's own page does not describe it.
All tools compared
| Tool | Laptop apps | SaaS accounts | Resources inside apps | Apps without SCIM | BYOD Macs, no enrollment | HR-triggered joiner and leaver | Sign-in |
|---|---|---|---|---|---|---|---|
| Caspian | Yes | Yes | Yes | Yes | Yes | Yes | Google Workspace or Entra |
| Jamf Pro | Yes | Not stated | Not stated | Not stated | No, needs enrollment | Not stated | Integrates with Entra, Google, Okta |
| Jamf Now | Yes | Not stated | Not stated | Not stated | Not stated | Not stated | Not stated |
| Iru | Yes | Not stated | Not stated | Not stated | Not stated | Not stated | Iru Workforce Identity |
| Mosyle | Yes | Not stated | Not stated | Not stated | Not stated | Not stated | Mosyle Auth 2 for the Mac login |
| JumpCloud | Yes, MDM | Yes, in lifecycle packages | Not stated | Not stated | Not stated | Not stated | JumpCloud SSO |
| Okta Lifecycle Management | No, not an MDM | Yes, via SCIM | Not stated | Needs Workflows or a person | No | Yes | Okta |
| Apple Business | App Store apps | No | No | No | No | Not described | Managed Apple Accounts from Google or Entra |
Sources are the vendor pages linked in each entry, checked 27 October 2026.
The three gaps in detail
SaaS app delivery
Jamf's integrations connect it to an identity provider such as Entra, Google or Okta. That covers sign-in. It does not create the account in each app or set what the person can do there. Many apps have no SCIM, or keep SCIM behind an enterprise plan, so an identity provider cannot reach them either. Slack, for example, offers SCIM provisioning only on Business+ and Enterprise (Slack help, checked 15 October 2026).
App discovery
Jamf inventories what is installed on the Macs it manages. Web apps and AI tools that people sign into from a browser do not show up there. To find them you need signals from the identity provider (OAuth grants in Google Workspace or Entra) and from the browser.
BYOD laptops
Apple's User Enrollment lets IT manage work data on a personal device without managing the whole device. Apple says the MDM can apply "only a limited set of payloads and restrictions" and can never manage "a user's personal account" (Apple Platform Deployment). The person still has to enroll. Many contractors, and some staff, will not let a company MDM onto their own Mac. An agent that checks the Mac without enrollment covers them.
If you have no MDM and no IT team
Our view: you may not need a paid MDM to start.
| Your situation | Our suggestion |
|---|---|
| Jamf in place, someone knows it | Keep Jamf. Add Caspian for SaaS app delivery, app discovery and BYOD |
| Jamf in place, nobody wants to run it | Keep it until renewal. Then compare Apple Business or Caspian MDM |
| No MDM, new Macs bought from Apple | Apple Business free MDM, plus Caspian |
| No MDM, mixed or personal Macs | Caspian Desktop, plus Caspian MDM in early access |
Caspian MDM is Caspian's own Apple MDM, in early access. It can move Macs from another MDM without a wipe on macOS 26 and later.
Trust and price
Caspian stores data in the EU (AWS Frankfurt). An independent pen test is planned, and ISO 27001 and SOC 2 are in progress. Caspian starts read-only, and you roll it out in stages. The software scan is free and read-only.
Caspian's own prices: See is free. Act, where Caspian does the work on your rules, is €10 per active user per month, excluding VAT, with all their laptops included. There is no minimum, Act is free for 30 days from install with no card, and billing is monthly and can be cancelled anytime. See pricing.
Questions to ask
- Which of our apps have an API, which have SCIM, and which have neither?
- Who creates accounts in those apps today, and how long does it take?
- When someone leaves, who removes their access, and how do we know it is done?
- How many people use a Mac that is not enrolled in our MDM?
- Which apps and AI tools do people use that our MDM inventory never shows?
- Does our MDM vendor provision accounts inside SaaS apps, or only devices?
FAQ
What does Jamf not cover for a small IT team? Jamf manages company-owned Apple devices: enrollment, settings, app deployment and compliance. Its product page does not describe SaaS app delivery, meaning the account and access in each SaaS app, and it does not discover browser-only apps or check personal Macs that are not enrolled. Those three gaps are where an IT management platform such as Caspian sits next to Jamf.
Can I keep Jamf and add Caspian? Yes. Jamf stays the source of truth for company Macs, and Caspian handles accounts in SaaS apps, the resources inside them, access requests in Slack, app discovery and BYOD laptops. Caspian does not read Jamf today, so the two run side by side.
How do I manage BYOD laptops without enrolling them in Jamf? Apple's User Enrollment still requires the person to enroll and limits what the MDM can apply. Caspian Desktop runs on Macs that are not enrolled in any MDM and checks FileVault, firewall, Gatekeeper, screen lock, macOS version and app versions. That covers contractors and staff who will not enroll a personal Mac.
Is there a cheaper alternative to Okta plus Jamf for a 150-person company on Google Workspace? For a 150-person company on Google Workspace, Google already handles sign-in, so Okta's main job is often already paid for. A common setup is Google Workspace for sign-in, Apple Business free MDM or Caspian MDM for devices, and Caspian for SaaS accounts, access and BYOD laptops. Whether it costs less depends on your contracts; Caspian publishes its own prices on its pricing page, with no minimum and monthly billing.
What should replace Jamf if we have no IT team? Start with the free MDM in Apple Business if you buy new Macs from Apple, or with Caspian MDM in early access for mixed fleets. Then run apps, accounts and access in Caspian. If you want one vendor for device, identity and compliance instead, Iru, Mosyle and JumpCloud are the usual options.
Request access to try Caspian next to Jamf.
Sources
| Source | Publisher | Date | Confidence |
|---|---|---|---|
| Jamf Pro | Jamf | Checked 27 Oct 2026 | High |
| Jamf Now | Jamf | Checked 27 Oct 2026 | High |
| Iru | Iru | Checked 27 Oct 2026 | High |
| Mosyle | Mosyle | Checked 27 Oct 2026 | High |
| Pricing | JumpCloud | Checked 27 Oct 2026 | High |
| Lifecycle Management | Okta | Checked 27 Oct 2026 | High |
| User Enrollment and MDM | Apple | Checked 27 Oct 2026 | High |
| Introducing Apple Business | Apple | 24 Mar 2026 | High |
| Free Apple device management is a baseline | 9to5Mac | 18 Apr 2026 | High |
| Francisco Partners completes acquisition of Jamf | Business Wire | 30 Jan 2026 | High |
| SCIM provisioning plans | Slack help | Checked 15 Oct 2026 | High |
| SP 800-53 Rev. 5 and PS-4 text | NIST, CSF Tools | Checked 27 Oct 2026 | High |
| 2026 Data Breach Investigations Report | Verizon | Checked 27 Oct 2026 | High |
| Pricing | Caspian | Checked 27 Oct 2026 | High (our own page) |
